To link to the entire object, paste this link in email, IM or documentTo embed the entire object, paste this HTML in websiteTo link to this page, paste this link in email, IM or documentTo embed this page, paste this HTML in website

Performance audit, Ray Unified School District

Performance audit, Ray Unified School District

Performance Audit
Ray Unified
School District
Division of School Audits
Debra K. Davenport
Auditor General
August • 2012
Report No. 12-11
A REPORT
TO THE
ARIZONA LEGISLATURE
The Auditor General is appointed by the Joint Legislative Audit Committee, a bipartisan committee composed of five senators and
five representatives. Her mission is to provide independent and impartial information and specific recommendations to improve the
operations of state and local government entities. To this end, she provides financial audits and accounting services to the State and
political subdivisions, investigates possible misuse of public monies, and conducts performance audits of school districts, state
agencies, and the programs they administer.
The Joint Legislative Audit Committee
Audit Staff
Ross Ehrick, Director
Ann Orrico, Manager and Contact Person
Jennie Snedecor, Team Leader
Tammy Seilheimer
Brian Smith
Copies of the Auditor General’s reports are free.
You may request them by contacting us at:
Office of the Auditor General
2910 N. 44th Street, Suite 410 • Phoenix, AZ 85018 • (602) 553-0333
Additionally, many of our reports can be found in electronic format at:
www.azauditor.gov
Representative Carl Seel, Chair
Representative Tom Chabin
Representative Justin Olson
Representative David Stevens
Representative Anna Tovar
Representative Andy Tobin (ex officio)
Senator Rick Murphy, Vice Chair
Senator Andy Biggs
Senator Rich Crandall
Senator Linda Lopez
Senator David Lujan
Senator Steve Pierce (ex officio)
2910 NORTH 44th STREET • SUITE 410 • PHOENIX, ARIZONA 85018 • (602) 553-0333 • FAX (602) 553-0051
MELANIE M. CHESNEY
DEPUTY AUDITOR GENERAL
DEBRA K. DAVENPORT, CPA
AUDITOR GENERAL
STATE OF ARIZONA
OFFICE OF THE
AUDITOR GENERAL
August 27, 2012
Members of the Arizona Legislature
The Honorable Janice K. Brewer, Governor
Governing Board
Ray Unified School District
Dr. Robert Dunn, Superintendent
Ray Unified School District
Transmitted herewith is a report of the Auditor General, A Performance Audit of the Ray Unified
School District, conducted pursuant to A.R.S. §41-1279.03. I am also transmitting within this
report a copy of the Report Highlights for this audit to provide a quick summary for your
convenience.
As outlined in its response, the District agrees with all of the findings and recommendations.
My staff and I will be pleased to discuss or clarify items in the report.
This report will be released to the public on August 28, 2012.
Sincerely,
Debbie Davenport
Auditor General
Student achievement similar to peer
averages—In fiscal year 2010, Ray USD’s
student AIMS scores for math and reading
were similar to peer districts’, and its
writing score was slightly lower. In
addition, two of the District’s three schools
met “Adequate Yearly Progress” for the
federal No Child Left Behind Act, and the
District’s 89-percent high school
graduation rate was higher than the
80-percent peer district average and
78-percent state average.
District operated efficiently—In fiscal
year 2010, Ray USD’s administrative costs
were similar to peer districts’. Further, the
District’s plant operations and food
service program operated efficiently with
lower costs than peer districts’. The
District’s plant operations costs were
lower because the District employed fewer
plant staff and had lower energy costs.
The District’s food service costs were
lower because it served fewer meals and
had lower supply costs. Lastly, the
District’s transportation program was
reasonably efficient with lower costs per
mile and efficient bus routes.
Similar student achievement and efficient operations
The District allowed one employee
complete control over certain aspects of
district operations without any oversight,
and this employee took advantage of the
lax control environment. Specifically, the
employee admitted to falsifying bus driver
drug test results and selling district
surplus property for his own financial gain.
Falsified drug test results—To meet the
bus driver drug testing requirements
found in the State’s Minimum Standards
for School Buses and School Bus Drivers
(Minimum Standards), the District allowed
one employee to control an in-house
drug-testing process from start to finish.
However, the lack of oversight and
controls provided the opportunity for the
employee to falsify drug test results. We
identified five altered drug test results
during our audit work. After we notified
officials of the falsified drug test results,
the employee admitted to falsifying two of
the five test results, and he resigned from
district employment.
Employee personally profited from sale
of surplus property—This same
employee also circumvented the District’s
surplus property policy when he sold parts
from the District’s old energy
management system that was being
Poor controls over important operations allowed fraudulent
and inappropriate activities to occur without timely detection
REPORT
HIGHLIGHTS
PERFORMANCE AUDIT
Our Conclusion
In fiscal year 2010, Ray
Unified School District’s
student achievement was
similar to peer districts’
but mostly lower than
state averages. The
District operated efficiently,
with administration, plant
operations, food service,
and transportation per-pupil
costs that were
similar to, or lower than,
peer districts’. However,
weak controls in several
areas have created an
environment in which
some fraudulent and
inappropriate activities
have occurred in recent
years. As a result, the
District needs to
strengthen controls over
its bus driver drug testing,
surplus property
disposition, and building
access. In addition, the
District needs to
strengthen its computer
controls and ensure that
its transportation program
meets all state
requirements.
2012
August • Report No. 12-11
Ray Unified
School District
Per Pupil Ray USD
Peer Group
Average
Administration $1,422 $1,447
Plant operations 1,145 1,473
Food service 368 428
Transportation 444 468
Comparison of Per-Pupil
Expenditures by Operational Area
Fiscal Year 2009
Percentage of Students Who Met or
Exceeded State Standards (AIMS)
Fiscal Year 2009
0%
10%
20%
30%
40%
50%
60%
70%
80%
90%
Math Reading Writing
Ray USD Peer Group State-wide
The State’s Minimum Standards require districts to
conduct annual drug tests as well as random drug
and alcohol tests of bus drivers. However, in fiscal
year 2010, eight of the District’s nine bus drivers did
not receive annual drug testing, and no drivers were
randomly tested for drug use. In addition, the
District is required to demonstrate that its school
buses receive systematic preventative maintenance
and inspections. Although the District maintained
records of oil changes, it did not maintain
documentation to show whether other preventative
maintenance activities were performed.
Recommendations—The District should:
••Ensure that annual and random bus driver
drug testing is performed according to state
standards.
••Develop and implement a checklist to document
preventative maintenance.
Transportation program did not meet all state requirements
Ray USD lacks adequate controls over its
accounting system and computer network. Three
district employees have more access to the
accounting system than is needed to perform their
job duties. Although no improper transactions were
detected in the sample we tested, access beyond
that which is necessary to perform job functions
exposes the District to increased risk of fraud and
errors. In addition, the District needs to strengthen
password requirements for its computer network
and create a formal disaster recovery plan.
Recommendations—The District should:
••Limit employees’ access to only those
accounting system functions needed to perform
their work.
••Increase the complexity requirements of
computer passwords.
••Create and implement a formal disaster
recovery plan.
Inadequate computer controls
REPORT
HIGHLIGHTS
PERFORMANCE AUDIT
August 2012
A copy of the full report is available at:
www.azauditor.gov
Contact person:
Ann Orrico (602) 553-0333
replaced. The employee removed the parts from the
old system that were still working and sold them on
the Internet and through other means. After we
notified the District of this inappropriate sale, the
employee admitted to receiving and keeping for
himself approximately $4,000 for the parts he sold.
The employee also admitted to a prior incident of
taking and selling copper from district buildings that
were being renovated and receiving about $3,000
from the sale of the copper.
Poor controls over building access—The District
also lacked oversight and controls over its process
for producing, distributing, and tracking keys for
district buildings to ensure that only authorized
employees are given keys. Specifically, one
employee is responsible for producing, numbering,
distributing, and tracking all keys without oversight.
Also, employees receiving keys are not required to
sign user agreements and there is no procedure in
place for ensuring that keys are collected from
employees leaving district employment. Further, we
identified at least one district office that was
accessible to only one employee. Allowing one
employee to have sole access to a secluded office
increased the risk of improper behavior, fraud, theft,
or abuse. In fact, we found that pornographic
images had been viewed on the computer kept in
that office.
Recommendations—The District should:
••Provide increased oversight and controls over
its in-house bus driver drug testing process
and contact the Department of Public Safety to
report the falsified drug tests.
••Strengthen its surplus property policy and
disseminate the policy to all current and future
employees to ensure they are aware of its
provisions.
••Implement controls over its process for
producing and distributing keys to district
buildings.
••Strengthen its policy prohibiting the accessing
of pornographic material on district computers
or its network and require employees to sign a
statement indicating they understand the policy
and its provisions.
Ray Unified
School District
TABLE OF CONTENTS
continued
page i
Office of the Auditor General
District Overview 1
Student achievement is similar to peer districts’ 1
District operates efficiently with most costs lower than or similar to peer districts’ 1
Finding 1: Poor controls over important operations allowed fraudulent
and inappropriate activities to occur without timely detection 3
Lax control environment allowed falsified bus driver drug test results to go undetected 3
Employee personally profited from sale of district surplus property 4
Lax control environment allowed a theft to go undetected for 6 months in the past 5
Poor controls over district keys and building access further increases the District’s risk
of theft, fraud, and misuse 5
Recommendations 6
Finding 2: Inadequate computer controls increase risk of errors
and fraud 7
Increased risk of unauthorized access to critical systems 7
Lack of disaster recovery plan could result in interrupted operations or loss of data 8
Recommendations 8
Finding 3: Transportation program did not meet all state requirements 9
District did not conduct drug testing according to Minimum Standards 9
District lacked proper preventative maintenance documentation 9
Recommendations 10
TABLE OF CONTENTS
concluded
page ii
State of Arizona
Appendix
Objectives, Scope, and Methodology a-1
District Response
Table
1 Comparison of Per-Pupil Expenditures by Operational Area
Fiscal Year 2010
(Unaudited) 2
Figure
1 Percentage of Students Who Met or Exceeded State Standards
Fiscal Year 2010
(Unaudited) 1
DISTRICT OVERVIEW
page 1
Office of the Auditor General
Ray Unified School District is a small, rural district located 85 miles southeast of Phoenix, in Pinal
County. In fiscal year 2010, the District served 528 students in kindergarten through 12th grade at its
three schools located on the same campus.
In fiscal year 2010, Ray USD was similar to its peers in student achievement and compared favorably
in operational efficiencies1. The District operated its administration, plant operations, food service,
and transportation programs with per-pupil costs that were similar to, or lower than, peer districts’
averages. However, weak controls in several areas have created an environment in which some
fraudulent activities have occurred in recent years. The District needs to strengthen controls over its
transportation drug testing, surplus property disposition, building access, and computer systems.
Further, the District should ensure it meets all state transportation requirements.
Student achievement is similar to peer districts’
In fiscal year 2010, 55 percent of the District’s students met
or exceeded state standards in math, 75 percent in
reading, and 65 percent in writing. As shown in Figure 1,
the District’s math and reading scores were similar to peer
districts’, and its writing score was slightly lower. In that
same fiscal year, two of the District’s schools met all
applicable “Adequate Yearly Progress” (AYP) objectives for
the federal No Child Left Behind Act, while its high school
did not because its fiscal year 2009 graduation rate of 77
percent was below its 2010 AYP target rate of 80 percent.
The District’s fiscal year 2010 89-percent graduation rate
was higher than the peer district’s 80-percent average and
the State’s 78-percent average.
District operates efficiently with most
costs lower than or similar to peer districts’
As shown in Table 1 on page 2, in fiscal year 2010, Ray USD spent a similar amount per pupil in the
classroom as peer districts—$4,954 versus $5,016. The District was able to do this despite spending
1 Auditors developed two peer groups for comparative purposes. See page a-1 of this reoprt’s Appendix for further explanation of the peer
groups.
Figure 1: Percentage of Students Who Met or
Exceeded State Standards (AIMS)
Fiscal Year 2010
(Unaudited)
Source: Auditor General staff analysis of fiscal year 2010 test results
on the Arizona’s Instrument to Measure Standards (AIMS).
0%
10%
20%
30%
40%
50%
60%
70%
80%
90%
Math Reading Writing
Ray USD
Peer Group
State-wide
page 2
State of Arizona
$895 less per pupil overall because it
operated efficiently with lower or similar per-pupil
costs in all operational areas.
Similar administrative costs but poor
controls over operations—At
$1,422 per pupil, the District’s
administrative costs were similar to the
peer districts’ average. However, lack of
oversight or controls has allowed fraudulent
activities to occur. For example, one
employee admitted to falsifying bus driver
drug testing documents and selling surplus
district property for his own profit (see
Finding 1, page 3). Further, the District
needs to strengthen controls over its
accounting system and computer network
(see Finding 2, page 7).
Lower plant operations and maintenance costs—Ray USD’s per-pupil plant operations
costs were 22 percent lower than peer districts’, and its per-square-foot costs were 43 percent
lower. Costs were lower, in part, because the District employed fewer plant staff per square foot.
Specifically, the District operated 23,876 square feet per employee while the peer districts
averaged 17,352 square feet per employee. Further, the District’s energy costs were 31 percent
lower per square foot in part because energy usage was controlled by a central energy
management system that monitored and adjusted building temperatures to keep them within a
district-approved range.
Food service program costs were lower—In addition to lower per-pupil food service costs,
Ray USD’s $2.79 cost per meal was 8 percent lower than the $3.04 peer district average. The
District’s per-pupil food service costs were lower, in part, because the District served fewer meals.
Further, the District’s per-meal costs were lower because it purchased considerably fewer general
supplies, such as cleaning supplies, than peer districts because it had supplies left over from the
prior fiscal year.
Transportation program operates reasonably efficiently—Ray USD’s transportation
program cost less per pupil than other districts, and its $1.97 cost per mile was 22 percent lower
than the peer districts’ average cost. Further, the District operated efficient bus routes, filling most
buses to an average of 86 percent of seat capacity. However, on a per-rider basis, the District’s
$1,101 cost was 38 percent higher than peer districts’ because the District transported its riders
28 percent more miles, on average. Location is a factor; the District’s campus is in the northwestern
corner of its boundaries, while students are spread throughout the District. Because of the shape
of the District’s boundaries, in order to reach students in the southern portion of its boundaries,
district buses must pass through a neighboring district’s boundaries. In addition, Ray USD also
transports open enrollment students from two neighboring districts. Both of these situations
increase the number of miles the District travels to transport students to and from school. Despite
operating a reasonably efficient program, the District did not meet all state requirements
concerning bus driver drug testing and bus preventative maintenance (see Finding 3, page 9).
Spending
Ray
USD
Peer
Group
Average
State
Average
Total per pupil $8,991 $9,887 $7,609
Classroom dollars 4,954 5,016 4,253
Nonclassroom
dollars
Administration 1,422 1,447 721
Plant operations 1,145 1,473 914
Food service 368 428 366
Transportation 444 468 342
Student support 393 625 581
Instructional
support 265 430 432
Table 1: Comparison of Per-Pupil
Expenditures by Operational Area
Fiscal Year 2010
(Unaudited)
Source: Auditor General staff analysis of fiscal year 2010
Arizona Department of Education student membership
data and district-reported accounting data.
page 3
Office of the Auditor General
FINDING 1
Poor controls over important operations allowed
fraudulent and inappropriate activities to occur without
timely detection
Fraudulent activities by two different district employees in recent years demonstrates that controls
over several aspects of the District’s operations need strengthening. Most recently, the District
allowed one employee complete control over certain aspects of district operations without any
oversight, and this employee took advantage of the lax control environment. Specifically, the
employee admitted to falsifying bus driver drug test results and selling district surplus property for
his own financial gain. At the time of this report’s release, the fraudulent acts this employee committed
are under further review by the Auditor General’s Office. The lack of oversight is even more troubling
because the District had already faced a similar situation where the lack of proper controls and
oversight allowed fraudulent activities involving a different employee to go undetected for several
months. Although both employees were terminated or resigned, the District needs to add the
appropriate controls to its operations to help ensure such abuses do not occur again, or are detected
more quickly. Another critical area in need of proper oversight and controls is the District’s building
access process. For example, one employee had the only key to a secluded office where his
computer was kept. Auditors found that this computer had been used for inappropriate activities.
Lax control environment allowed falsified bus driver drug test
results to go undetected
According to the State’s Minimum Standards for School Buses and School Bus Drivers (Minimum
Standards), districts are required to ensure that bus drivers are tested annually for drug usage and
randomly throughout the school year for drug and alcohol usage. Typically, bus drivers obtain annual
and random drug testing through laboratories or other medical facilities, such as hospitals or clinics.
However, since at least fiscal year 2001, Ray USD has used an in-house drug testing system that
involves collecting samples at the District and sending them to a laboratory for analysis. According
to district officials, the District adopted this practice as a cost-saving measure.
Although this practice can be acceptable if handled appropriately, the District allowed the in-house
drug testing process to be handled by one employee who controlled the process from start to finish.
The lack of oversight of this employee’s work and the lack of formal procedures or controls over the
page 4
State of Arizona
process provided opportunity for the employee to falsify bus driver drug test results, which went
undetected until auditors discovered them as part of their normal audit work. Auditors reviewed
files, including required drug test results, for all ten bus drivers who drove district buses during
fiscal years 2009, 2010, and/or 2011 and found five falsified drug test results. In four cases, the
employee name on the drug test document was clearly altered, and in the fifth case, the list of
specific drugs that were tested for was clearly altered.
After auditors notified district officials of the falsified drug test results, the employee admitted to
falsifying two of the five test results, and he resigned from district employment. However, this
does little to reduce the potential for abuse. To ensure the integrity of its in-house drug testing
process and test results, the District should develop policies and procedures related to the
process, including oversight and controls that would allow for quick detection of fraud. For
example, the District should consider having drug test results mailed from the testing lab directly
to the district office and opened by two employees who are not otherwise involved in the
transportation program. Further, to protect students and the public, the District should report the
falsified drug test results to the Department of Public Safety (DPS). DPS administers the State’s
Minimum Standards, which requires bus driver drug testing, among other things, to maintain
school bus driver credentials.
Employee personally profited from sale of district surplus
property
Although the District had a policy for disposing of surplus property, the same employee
discussed above was able to easily circumvent it. This employee, who was also in charge of
overseeing the installation of a new energy management system, did not follow the policy when
he sold parts from the old system for personal profit. The employee obtained the old energy
management system when the vendor removed it in order to install the new system. Rather than
notifying district office staff that he had collected surplus property and ensuring its proper
disposal, the employee removed the parts from the old system that were still working and
personally sold them on the Internet and through other means. After auditors notified district
officials of this inappropriate sale, the employee admitted receiving and keeping for himself
approximately $4,000 for the parts he sold. The employee also admitted to a prior incident of
taking and selling copper from district buildings that were being renovated. In this case, the
employee estimated he personally received about $3,000 from selling the copper.
Once again, the fact that the employee subsequently resigned does not address the underlying
problem: the policy is too easily ignored. The policy, which addresses how surplus property
should be disposed, should be strengthened to (1) include employees’ responsibility to notify
designated district officials when they identify items that could be declared as surplus property,
and (2) specify that employees should not personally take, keep, or sell any district property
unless designated district officials have determined it is allowable based on the requirements of
page 5
Office of the Auditor General
Arizona Administrative Code R7-2-1131.1 Further, the District should ensure that all current and future
employees are aware of its surplus property policy and the importance of following the policy when
identifying and disposing of surplus property by disseminating the policy to all new and current
employees once it is strengthened.
Lax control environment allowed a theft to go undetected for 6
months in the past
The fraudulent activities discussed earlier were not the first experienced by the District. In 2010, a
former employee pled guilty to stealing almost $9,000 while working in the district office. The theft
occurred in 2008, when the employee took advantage of the lax control environment to use district
credit cards to pay personal bills and to steal money from the District’s cash receipts. The theft went
undetected for about 6 months before an unusual credit card purchase signaled district officials that
something was wrong. Since this theft occurred, the District has strengthened its controls over credit
cards and cash.
Poor controls over district keys and building access further
increases the District’s risk of theft, fraud, and misuse
Another aspect of district operations that needs strengthening is its process for producing,
distributing, and tracking keys for district buildings. The District’s process for making and distributing
all building keys does not include oversight or process controls to ensure that only authorized
employees are given keys to various buildings or areas within the District. Because of the lack of
controls, the District cannot know at any point in time how many district keys exist and who has them.
Specifically,
•• The District does not have a formal key-request procedure. Employees needing keys often
verbally request them from the employee who produces the keys. In addition to producing all
keys, this employee is also responsible for numbering, distributing, and tracking the keys
without any oversight or involvement from other employees.
•• A complete and up-to-date log showing keys made and distributed is not kept.
•• Employees receiving keys are not required to sign user agreements, which would clearly outline
the rules and policies an employee must follow regarding the use of a district key and provide
additional identification of which district employee was in possession of which key(s).
•• No procedure is in place for ensuring that keys are collected from employees when they leave
district employment.
•• At least one office in the District was accessible to only one employee. Specifically, the District
allowed one employee to have sole access to a secluded office where his computer was kept.
1 According to Arizona Administrative Code R7-2-1131, a school district employee or board member cannot purchase surplus property if they
were directly or indirectly involved in the purchase, disposal, maintenance, or preparation for sale of the surplus property.
page 6
State of Arizona
Even the superintendent did not have a key to that particular office. Allowing an employee
to have sole access to a secluded office increases the risk of improper behavior, fraud, theft,
or abuse. In fact, despite a district policy prohibiting the viewing of pornography on district
computers or its network and a filter that blocks users from accessing pornographic images
from the Internet, auditors found that pornographic images had been viewed from an
external hard drive on this employee’s computer. As of fiscal year 2013, this employee no
longer works at the District. Strengthening the District’s policy to include consequences,
such as disciplinary action or dismissal, and requiring employees to sign a statement
acknowledging their understanding of the policy and its provisions would help to ensure
that the policy is not ignored in the future. Further, the computer was the only district
computer housing critical and costly energy management software used to monitor and
control temperatures throughout the District’s facilities. Since no other district personnel had
access to that office or computer, it would have been difficult for district officials to access
the energy management system in the employee’s absence.
Recommendations
1. The District should develop policies and procedures over its in-house drug testing process,
including increased oversight and controls that would allow for quick detection of fraud
and abuse, such as having drug test results sent directly to the district office and opened
by two employees who are not otherwise involved with transportation.
2. The District should contact the Department of Public Safety to report the falsified drug test
results.
3. The District should strengthen its surplus property policy to specify that employees must
notify designated district officials when they identify items that could be declared as
surplus property. Further, the policy should specify that employees should not personally
take, keep, or sell any district property unless designated district officials have determined
it is allowable based on the requirements of Arizona Administrative Code R7-2-1131. The
District should also disseminate its surplus property policy to all current and future
employees to ensure they are aware of the policy’s provisions. Finally, the District should
ensure that surplus property is disposed of according to the policy.
4. The District should implement controls over its process for producing and distributing keys
to district buildings, including numbering all keys produced, establishing a distribution log,
and creating and following a procedure for ensuring that keys are returned when an
employee leaves district employment. In addition, district officials should evaluate if and
when it would be appropriate to allow an individual to have sole access to an office and
limit such a situation as much as possible.
5. The District should strengthen its policy prohibiting the accessing of pornographic material
on district computers or its network to include consequences, such as disciplinary action
or dismissal. The District should also require employees to sign a statement indicating they
understand the policy and its provisions.
page 7
Office of the Auditor General
FINDING 2
Inadequate computer controls increase risk of errors and
fraud
Ray USD lacks adequate controls over its accounting system and computer network. Unlike the
areas discussed in Finding 1, auditors did not detect any improper transactions in these areas.
However, these poor controls expose the District to increased risk of errors and potential fraud.
Increased risk of unauthorized access to critical systems
Weak controls over user access to the District’s accounting system and network increase the risk of
unauthorized access to these critical systems.
Broad access to accounting system increases risk of errors, fraud, and misuse
of sensitive information—Auditors reviewed the District’s user access report for the four
users with access to the accounting system and found that three district employees have more
access to the accounting system than they need to perform their job duties. All three of these
employees have the ability to perform all accounting system functions. Full access in the
accounting system provides an employee with the ability to add new vendors, create and approve
purchase orders, and pay vendors without independent review. It also provides the ability to add
new employees, set employee pay rates, and process payroll payments. Access to all accounting
system functions and beyond what is required for job duties exposes the District to increased risk
of errors, fraud, and misuse of information, such as processing false invoices or adding and
paying nonexistent vendors or employees.
Weak password requirements—The District needs stronger controls over its network
passwords. Although network passwords are user-defined and must be changed periodically, the
passwords have a low-complexity requirement—that is, passwords need not contain numbers or
symbols. Common practice requires passwords to be at least eight characters and contain a
combination of alphabetic and numeric characters. This practice would decrease the risk of
unauthorized persons gaining access to the District’s systems.
page 8
State of Arizona
Lack of disaster recovery plan could result in interrupted
operations or loss of data
The District does not have a formal, up-to-date, and tested disaster recovery plan for critical
student information on its systems and network. A written and properly designed disaster
recovery plan would help ensure continued operations in the case of a system or equipment
failure or interruption. Although the District creates backups of critical data and stores the
backups in a secure location, the District does not regularly test its ability to restore electronic
data files from the backups, which could result in the loss of sensitive and critical data. Disaster
recovery plans should be tested periodically and modifications made to correct any problems
and to ensure their effectiveness.
Recommendations
1. The District should review employee access to the accounting system and modify access
to ensure that an employee cannot initiate and complete a transaction without independent
review and that each employee has only the access necessary to meet their job
responsibilities.
2. The District should implement stronger password controls, requiring its employees to
create more secure passwords that contain a combination of alphabetic and numeric
characters.
3. The District should create a formal disaster recovery plan and test it periodically to identify
and remedy any deficiencies.
page 9
Office of the Auditor General
FINDING 3
Transportation program did not meet all state
requirements
Although Ray USD’s transportation program operated reasonably efficiently in fiscal year 2010 with
per-mile costs that were lower than peer districts’, the District failed to meet two state requirements
within its transportation program—testing its bus drivers for drug usage, and documenting that
buses receive required preventative maintenance.
District did not conduct drug testing according to Minimum
Standards
In addition to the falsified drug test results discussed in Finding 1 (see page 3), the District did not
ensure that all of its bus drivers received annual or random drug testing in accordance with
requirements set forth in the State’s Minimum Standards for School Buses and School Bus Drivers
(Minimum Standards). These standards require that all bus drivers be tested annually for drug usage.
Further, the standards also require that random testing be performed on 50 percent of bus drivers
for drug use and on 10 percent of bus drivers for alcohol use each year. In fiscal year 2010, eight of
the nine Ray USD bus drivers did not receive annual drug testing. Further, although the District
randomly tested a sufficient percentage of bus drivers for alcohol use, it did not randomly test any
bus drivers for drug use.
District lacked proper preventative maintenance documentation
According to the State’s Minimum Standards, districts must demonstrate that their school buses
receive systematic preventative maintenance and inspections. Following the Minimum Standards
helps to ensure the safety and welfare of students and can help extend buses’ useful lives.
Preventative maintenance and inspections include items such as periodic oil changes, tire and break
inspections, and inspections of safety signals and emergency exits. Although the District maintained
documentation of oil changes, it did not maintain documentation, such as a checklist, to show
whether other preventative maintenance activities were performed. The lack of such documentation
means the District cannot demonstrate that its school buses are being properly maintained according
to the Minimum Standards.
page 10
State of Arizona
Recommendations
1. The District should ensure that it conducts all required annual and random drug testing as
specified in the Minimum Standards.
2. The District should develop and implement the use of a checklist to document that its
buses receive required preventative maintenance as specified in the State’s Minimum
Standards.
APPENDIX
page a-1
Office of the Auditor General
Objectives, Scope, and Methodology
The Office of the Auditor General has conducted a performance audit of the Ray Unified School
District pursuant to A.R.S. §41-1279.03(A)(9). Based in part on their effect on classroom dollars, as
previously reported in the Auditor General’s annual report, Arizona School District Spending
(Classroom Dollars report), this audit focused on the District’s efficiency and effectiveness in four
operational areas: administration, plant operations and maintenance, food service, and student
transportation. To evaluate costs in each of these areas, only current expenditures, primarily for fiscal
year 2010, were considered.1 Further, because of the underlying law initiating these performance
audits, auditors also reviewed the District’s use of Proposition 301 sales tax monies and how it
accounted for dollars spent in the classroom.
In conducting this audit, auditors used a variety of methods, including examining various records,
such as available fiscal year 2010 summary accounting data for all districts and Ray USD’s fiscal
year 2010 detailed accounting data, contracts, and other district documents; reviewing district
policies, procedures, and related internal controls; reviewing applicable statutes; and interviewing
district administrators and staff.
To analyze Ray USD’s operational efficiency, auditors selected a group of peer districts based on
their similarities in district size, type, and location. This operational peer group includes Ray USD and
17 other high school and unified school districts that also served between 200 and 599 students and
were located in town/rural areas.2 To compare districts’ academic indicators, auditors developed a
separate student achievement peer group using poverty as the primary factor because poverty has
been shown to be strongly related to student achievement. Auditors also used secondary factors
such as district type, size, and location to further refine these groups. Ray USD’s student achievement
peer group includes Ray USD and the 21 other unified districts that also served student populations
with poverty rates between 17 and 23 percent. Additionally:
•• To assess the District’s student achievement, auditors reviewed the Arizona’s Instrument to
Measure Standards (AIMS) passing rates, “Adequate Yearly Progress” for the federal No Child
Left Behind Act, and high school graduation rates. AIMS passing rates were compared to the
state-wide average and the average of the student achievement peer districts.
•• To assess whether the District’s transportation program was managed appropriately and
functioned efficiently, auditors reviewed and evaluated required transportation reports; bus
1 Current expenditures are those incurred for the District’s day-to-day operations. They exclude costs associated with repaying debt, capital
outlay (such as purchasing land, buildings, and equipment), and programs such as adult education and community service that are outside
the scope of preschool through grade-12 education.
2 The operational peer group excludes two districts that each received such high levels of additional funding that they skewed the peer-spending
averages.
page a-2
State of Arizona
driver files, including driver drug test results; bus maintenance and safety records; bus
routing; and bus capacity usage. Auditors also reviewed fiscal year 2010 transportation
costs and compared them to peer districts’.
•• To assess the District’s financial accounting data, auditors evaluated the District’s internal
controls related to expenditure processing and scanned all payroll and accounts payable
transactions for proper account classification and reasonableness. Additionally, auditors
reviewed detailed payroll and personnel records for 30 of the 120 individuals who received
payments through the District’s payroll system and reviewed supporting documentation for
30 of the 3,776 accounts payable transactions. No improper transactions were identified.
Auditors also evaluated other internal controls that were considered significant to the audit
objectives, such reviewing the District’s policies and procedures for disposing of surplus
property and controlling access to district buildings.
•• To assess the District’s computer information systems and network, auditors evaluated
certain controls over its logical and physical security, including user access to sensitive data
and critical systems, and the security of servers that house the data and systems. Auditors
also evaluated certain district policies over the system such as data sensitivity, backup,
recovery, and computer equipment and network acceptable use.
•• To assess whether the District’s administration effectively and efficiently managed district
operations, auditors evaluated administrative procedures and controls at the district and
school level, including reviewing personnel files and other pertinent documents and
interviewing district and school administrators about their duties. Auditors also reviewed
and evaluated fiscal year 2010 administration costs and compared these to peer districts’.
•• To assess whether the District’s plant operations and maintenance function was managed
appropriately and functioned efficiently, auditors reviewed and evaluated fiscal year 2010
plant operations and maintenance costs and district building space, and compared these
costs and capacities to peer districts’.
•• To assess whether the District’s food service program was managed appropriately and
functioned efficiently, auditors reviewed fiscal year 2010 food service revenues and
expenditures, including labor and food costs, compared costs to peer districts’, reviewed
the Arizona Department of Education’s food service monitoring reports, and observed food
service operations.
•• To assess whether the District was in compliance with Proposition 301’s Classroom Site
Fund requirements, auditors reviewed fiscal year 2010 expenditures to determine whether
they were appropriate and if the District properly accounted for them. Auditors also reviewed
the District’s performance pay plan and analyzed how performance pay was being
distributed. No issues of noncompliance were noted.
We conducted this performance audit in accordance with generally accepted government
auditing standards. Those standards require that we plan and perform the audit to obtain
sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions
based on our audit objectives. We believe that the evidence obtained provides a reasonable
basis for our findings and conclusions based on our audit objectives.
The Auditor General and her staff express their appreciation to the Ray Unified School District’s
board members, superintendent, and staff for their cooperation and assistance throughout the
audit.
DISTRICT RESPONSE
DISTRICT RESPONSE
Responses to the Findings and Recommendations
Ray Unified School District #3 Page | 1
Finding 1
Poor controls over important operations allowed fraudulent and inappropriate activities
to occur without timely detection.
 Lax control environment allowed falsified bus driver drug test results to go undetected.
Response: The District agrees with this finding. We have already initiated steps that
will allow for increased oversight and controls for quick detection of fraud and abuse.
Currently, drug test results are sent directly to the district office and will be opened by
two employees who are not directly involved in transportation. The Transportation
Director has contacted the Department of Public Safety to report the falsified drug test
results.
 Employee personally profited from sale of district surplus property.
Response: The District agrees with this finding. We will strengthen our current policy
which will be provided at the August 16, 2012 meeting. This will include having
employees notify designated district officials when they identify items that could be
declared as surplus property. In addition, it will specify that employees would not
personally take, keep, or sell any district property unless designated district officials
having determined it is allowable based on the requirements of Arizona Code or 7-2-
11-31. The new policy will be distributed to all current and future employees to make
them aware of the district’s surplus property policy.
 Poor controls over District keys and building access further increases the District’s
risk of theft, fraud, and misuse.
Response: The District agrees with this finding. All employees will be required to sign
user agreements acknowledging their understanding of the policy and its provisions.
The user agreement will include consequences, e.g. disciplinary action or dismissal. A
procedure will be put in place for insuring that keys are collected from employees
when they leave District employment. District officials will evaluate if and when it
would be appropriate to allow an individual sole access to an office and limit such as
much as possible.
For your information, the computer housing the energy management software is now
accessible to the maintenance director, technology director, superintendent, and
business manager. In addition, the District currently numbers all keys produced. A
key distribution log will be established at each site with a master log located at the
district office and at the maintenance director’s office.
The District will strengthen its policy prohibiting the accessing of pornographic
material on District computers or its network. This policy will also include
consequences, e.g. disciplinary action or dismissal for those employees who violate
this policy. District employees will be required to sign a statement indicating that they
understand the policy and its provisions.
Responses to the Findings and Recommendations
Ray Unified School District #3 Page | 2
Finding 2
Inadequate computer controls increase risk of errors and fraud.
 Increased risk of unauthorized access to critical systems
Response: The District agrees with this finding. The District understands the auditor’s
recommendation regarding employee access to the accounting system. However, with
only two full time employees in the District Office it would be difficult for each
employee to only have access to the information to meet their job responsibilities. In
addition, the District has always cross trained employees to safe guard against the
possibility that if either employee would be absent for an extended period of time the
job responsibilities of the employee absent could be performed by the other employee.
This is especially true if the accounts payable/payroll clerk would be absent, since
many of her duties are time sensitive. Compensating controls have been implemented
to correct this finding: (a) a second and third review of all payroll and accounts
payable warrants issued including a system generated listing, which cannot be filtered
or altered, for each voucher that details all warrants paid; (b) all requisitions are
reviewed and signed by the Superintendent and Business Manager; (c) a part time
clerk reviews and initials the listing of every payroll and accounts payable warrant
issued by the district to ensure that there are no pseudo employees or vendors paid.
 Weak password requirements
Response: The District agrees with this finding. The Technology Director sent an
email to all district employees on August 9, 2012. He has directed all staff that they
will be required to change their password to at least 8 alphanumeric characters for
Windows and SchoolMaster, beginning August 13, 2012. Besides 8 alphanumeric
characters, the password may not contain your full or partial name, the password
cannot be one used in the past 5 changes, and the password will expire every one
hundred eighty days.
 Lack of disaster recovery plan could result in interrupted operations or loss of data.
Response: The District agrees with this finding. The District is in the process of
revising the disaster recovery plan and assigning responsibilities to key personnel,
including a flow chart. The recovery plan will integrate the practice of running the
verification tool for all the backups to ensure all the files in the backup are physically
intact, readable, and can be restored in the event the recovery is needed due to
hardware failure. The backups will be tested on a monthly basis to ensure that the
integrity of the data is intact. The District will deploy an additional server to hold
replicas of all the virtual machines to use in the case of hardware failure to ensure
business continuity. Additional software is being considered to allow the District to
verify the integrity of the backup.
Responses to the Findings and Recommendations
Ray Unified School District #3 Page | 3
Finding 3
Transportation program did not meet all state requirements.
 District did not conduct drug testing according to Minimum Standards.
Response: The District agrees with this finding. Procedures for drug testing
transportation employees have been implemented. The District Superintendent
receives from Hire Right those individual(s) who must be randomly screened. The
Superintendent informs the Transportation Supervisor of those name(s). The
Transportation Supervisor schedules those employees to be tested with the District
Nurse. The nurse completes the screening and forwards to the District Superintendent
the Federal Drug Testing Custody and Control Form. A copy of this form is then
given to the Transportation Supervisor. Hire Right sends the drug test results via fax
to the District Superintendent. The District fax machine is in a secure location. This
process is followed for all transportation employees for their pre-employment or
annual tests, except that the process in initiated by the Transportation Supervisor.
 District lacked proper preventative maintenance documentation
Response: The District agrees with this finding. The Transportation Director has
developed a computer check list to document preventative maintenance/routine
maintenance on all buses.
See attached Corrective Action Plan
Corrective Action Plan
Ray Unified School District #3
Area Corrective Action
Bus driver drug testing results All current drivers to be tested immediately
Notify Department of Public Safety that drug tests were falsified
Drug test results will go directly to Dr. Dunn from Hire Right and not to the
Transportation Director
Sale of Surplus Property Strengthen current surplus property policy (DN, D‐3350).
Distribute new surplus property policy to all employees
District Keys Create an agreement form to be signed by all employees who have been assigned
a key(s)
Create a Key Control Procedure
Key log to be kept at each site and a master log to be kept in the District Office
Technology Resources Strengthen current Use of Technology Resources in Instruction Policy (IJNDB‐E, I‐
6431)
Distribute new User Agreement to all employees and track that forms are signed
and returned to the District Office by each employee
Access to Critical Systems Implement controls to prevent creation of a pseudo vendor or employee
Password Requirements System passwords must be strengthened to deter unauthorized use of critical
systems
Disaster Recovery Plan Revise the disaster recovery plan to include a procedure for back up that defines
critical resources/applications and defines the responsibilities of key personnel.
Develop a flow chart detailing the responsibilities of key personnel.
Purchase software to allow the Technology Director to verify the integrity of the
backup.
Proper PM on all District Vehicles. Document PM on District vehicles and log all such work

Copyright to this resource is held by the creating agency and is provided here for educational purposes only. It may not be downloaded, reproduced or distributed in any format without written permission of the creating agency. Any attempt to circumvent the access controls placed on this file is a violation of United States and international copyright laws, and is subject to criminal prosecution.

Performance Audit
Ray Unified
School District
Division of School Audits
Debra K. Davenport
Auditor General
August • 2012
Report No. 12-11
A REPORT
TO THE
ARIZONA LEGISLATURE
The Auditor General is appointed by the Joint Legislative Audit Committee, a bipartisan committee composed of five senators and
five representatives. Her mission is to provide independent and impartial information and specific recommendations to improve the
operations of state and local government entities. To this end, she provides financial audits and accounting services to the State and
political subdivisions, investigates possible misuse of public monies, and conducts performance audits of school districts, state
agencies, and the programs they administer.
The Joint Legislative Audit Committee
Audit Staff
Ross Ehrick, Director
Ann Orrico, Manager and Contact Person
Jennie Snedecor, Team Leader
Tammy Seilheimer
Brian Smith
Copies of the Auditor General’s reports are free.
You may request them by contacting us at:
Office of the Auditor General
2910 N. 44th Street, Suite 410 • Phoenix, AZ 85018 • (602) 553-0333
Additionally, many of our reports can be found in electronic format at:
www.azauditor.gov
Representative Carl Seel, Chair
Representative Tom Chabin
Representative Justin Olson
Representative David Stevens
Representative Anna Tovar
Representative Andy Tobin (ex officio)
Senator Rick Murphy, Vice Chair
Senator Andy Biggs
Senator Rich Crandall
Senator Linda Lopez
Senator David Lujan
Senator Steve Pierce (ex officio)
2910 NORTH 44th STREET • SUITE 410 • PHOENIX, ARIZONA 85018 • (602) 553-0333 • FAX (602) 553-0051
MELANIE M. CHESNEY
DEPUTY AUDITOR GENERAL
DEBRA K. DAVENPORT, CPA
AUDITOR GENERAL
STATE OF ARIZONA
OFFICE OF THE
AUDITOR GENERAL
August 27, 2012
Members of the Arizona Legislature
The Honorable Janice K. Brewer, Governor
Governing Board
Ray Unified School District
Dr. Robert Dunn, Superintendent
Ray Unified School District
Transmitted herewith is a report of the Auditor General, A Performance Audit of the Ray Unified
School District, conducted pursuant to A.R.S. §41-1279.03. I am also transmitting within this
report a copy of the Report Highlights for this audit to provide a quick summary for your
convenience.
As outlined in its response, the District agrees with all of the findings and recommendations.
My staff and I will be pleased to discuss or clarify items in the report.
This report will be released to the public on August 28, 2012.
Sincerely,
Debbie Davenport
Auditor General
Student achievement similar to peer
averages—In fiscal year 2010, Ray USD’s
student AIMS scores for math and reading
were similar to peer districts’, and its
writing score was slightly lower. In
addition, two of the District’s three schools
met “Adequate Yearly Progress” for the
federal No Child Left Behind Act, and the
District’s 89-percent high school
graduation rate was higher than the
80-percent peer district average and
78-percent state average.
District operated efficiently—In fiscal
year 2010, Ray USD’s administrative costs
were similar to peer districts’. Further, the
District’s plant operations and food
service program operated efficiently with
lower costs than peer districts’. The
District’s plant operations costs were
lower because the District employed fewer
plant staff and had lower energy costs.
The District’s food service costs were
lower because it served fewer meals and
had lower supply costs. Lastly, the
District’s transportation program was
reasonably efficient with lower costs per
mile and efficient bus routes.
Similar student achievement and efficient operations
The District allowed one employee
complete control over certain aspects of
district operations without any oversight,
and this employee took advantage of the
lax control environment. Specifically, the
employee admitted to falsifying bus driver
drug test results and selling district
surplus property for his own financial gain.
Falsified drug test results—To meet the
bus driver drug testing requirements
found in the State’s Minimum Standards
for School Buses and School Bus Drivers
(Minimum Standards), the District allowed
one employee to control an in-house
drug-testing process from start to finish.
However, the lack of oversight and
controls provided the opportunity for the
employee to falsify drug test results. We
identified five altered drug test results
during our audit work. After we notified
officials of the falsified drug test results,
the employee admitted to falsifying two of
the five test results, and he resigned from
district employment.
Employee personally profited from sale
of surplus property—This same
employee also circumvented the District’s
surplus property policy when he sold parts
from the District’s old energy
management system that was being
Poor controls over important operations allowed fraudulent
and inappropriate activities to occur without timely detection
REPORT
HIGHLIGHTS
PERFORMANCE AUDIT
Our Conclusion
In fiscal year 2010, Ray
Unified School District’s
student achievement was
similar to peer districts’
but mostly lower than
state averages. The
District operated efficiently,
with administration, plant
operations, food service,
and transportation per-pupil
costs that were
similar to, or lower than,
peer districts’. However,
weak controls in several
areas have created an
environment in which
some fraudulent and
inappropriate activities
have occurred in recent
years. As a result, the
District needs to
strengthen controls over
its bus driver drug testing,
surplus property
disposition, and building
access. In addition, the
District needs to
strengthen its computer
controls and ensure that
its transportation program
meets all state
requirements.
2012
August • Report No. 12-11
Ray Unified
School District
Per Pupil Ray USD
Peer Group
Average
Administration $1,422 $1,447
Plant operations 1,145 1,473
Food service 368 428
Transportation 444 468
Comparison of Per-Pupil
Expenditures by Operational Area
Fiscal Year 2009
Percentage of Students Who Met or
Exceeded State Standards (AIMS)
Fiscal Year 2009
0%
10%
20%
30%
40%
50%
60%
70%
80%
90%
Math Reading Writing
Ray USD Peer Group State-wide
The State’s Minimum Standards require districts to
conduct annual drug tests as well as random drug
and alcohol tests of bus drivers. However, in fiscal
year 2010, eight of the District’s nine bus drivers did
not receive annual drug testing, and no drivers were
randomly tested for drug use. In addition, the
District is required to demonstrate that its school
buses receive systematic preventative maintenance
and inspections. Although the District maintained
records of oil changes, it did not maintain
documentation to show whether other preventative
maintenance activities were performed.
Recommendations—The District should:
••Ensure that annual and random bus driver
drug testing is performed according to state
standards.
••Develop and implement a checklist to document
preventative maintenance.
Transportation program did not meet all state requirements
Ray USD lacks adequate controls over its
accounting system and computer network. Three
district employees have more access to the
accounting system than is needed to perform their
job duties. Although no improper transactions were
detected in the sample we tested, access beyond
that which is necessary to perform job functions
exposes the District to increased risk of fraud and
errors. In addition, the District needs to strengthen
password requirements for its computer network
and create a formal disaster recovery plan.
Recommendations—The District should:
••Limit employees’ access to only those
accounting system functions needed to perform
their work.
••Increase the complexity requirements of
computer passwords.
••Create and implement a formal disaster
recovery plan.
Inadequate computer controls
REPORT
HIGHLIGHTS
PERFORMANCE AUDIT
August 2012
A copy of the full report is available at:
www.azauditor.gov
Contact person:
Ann Orrico (602) 553-0333
replaced. The employee removed the parts from the
old system that were still working and sold them on
the Internet and through other means. After we
notified the District of this inappropriate sale, the
employee admitted to receiving and keeping for
himself approximately $4,000 for the parts he sold.
The employee also admitted to a prior incident of
taking and selling copper from district buildings that
were being renovated and receiving about $3,000
from the sale of the copper.
Poor controls over building access—The District
also lacked oversight and controls over its process
for producing, distributing, and tracking keys for
district buildings to ensure that only authorized
employees are given keys. Specifically, one
employee is responsible for producing, numbering,
distributing, and tracking all keys without oversight.
Also, employees receiving keys are not required to
sign user agreements and there is no procedure in
place for ensuring that keys are collected from
employees leaving district employment. Further, we
identified at least one district office that was
accessible to only one employee. Allowing one
employee to have sole access to a secluded office
increased the risk of improper behavior, fraud, theft,
or abuse. In fact, we found that pornographic
images had been viewed on the computer kept in
that office.
Recommendations—The District should:
••Provide increased oversight and controls over
its in-house bus driver drug testing process
and contact the Department of Public Safety to
report the falsified drug tests.
••Strengthen its surplus property policy and
disseminate the policy to all current and future
employees to ensure they are aware of its
provisions.
••Implement controls over its process for
producing and distributing keys to district
buildings.
••Strengthen its policy prohibiting the accessing
of pornographic material on district computers
or its network and require employees to sign a
statement indicating they understand the policy
and its provisions.
Ray Unified
School District
TABLE OF CONTENTS
continued
page i
Office of the Auditor General
District Overview 1
Student achievement is similar to peer districts’ 1
District operates efficiently with most costs lower than or similar to peer districts’ 1
Finding 1: Poor controls over important operations allowed fraudulent
and inappropriate activities to occur without timely detection 3
Lax control environment allowed falsified bus driver drug test results to go undetected 3
Employee personally profited from sale of district surplus property 4
Lax control environment allowed a theft to go undetected for 6 months in the past 5
Poor controls over district keys and building access further increases the District’s risk
of theft, fraud, and misuse 5
Recommendations 6
Finding 2: Inadequate computer controls increase risk of errors
and fraud 7
Increased risk of unauthorized access to critical systems 7
Lack of disaster recovery plan could result in interrupted operations or loss of data 8
Recommendations 8
Finding 3: Transportation program did not meet all state requirements 9
District did not conduct drug testing according to Minimum Standards 9
District lacked proper preventative maintenance documentation 9
Recommendations 10
TABLE OF CONTENTS
concluded
page ii
State of Arizona
Appendix
Objectives, Scope, and Methodology a-1
District Response
Table
1 Comparison of Per-Pupil Expenditures by Operational Area
Fiscal Year 2010
(Unaudited) 2
Figure
1 Percentage of Students Who Met or Exceeded State Standards
Fiscal Year 2010
(Unaudited) 1
DISTRICT OVERVIEW
page 1
Office of the Auditor General
Ray Unified School District is a small, rural district located 85 miles southeast of Phoenix, in Pinal
County. In fiscal year 2010, the District served 528 students in kindergarten through 12th grade at its
three schools located on the same campus.
In fiscal year 2010, Ray USD was similar to its peers in student achievement and compared favorably
in operational efficiencies1. The District operated its administration, plant operations, food service,
and transportation programs with per-pupil costs that were similar to, or lower than, peer districts’
averages. However, weak controls in several areas have created an environment in which some
fraudulent activities have occurred in recent years. The District needs to strengthen controls over its
transportation drug testing, surplus property disposition, building access, and computer systems.
Further, the District should ensure it meets all state transportation requirements.
Student achievement is similar to peer districts’
In fiscal year 2010, 55 percent of the District’s students met
or exceeded state standards in math, 75 percent in
reading, and 65 percent in writing. As shown in Figure 1,
the District’s math and reading scores were similar to peer
districts’, and its writing score was slightly lower. In that
same fiscal year, two of the District’s schools met all
applicable “Adequate Yearly Progress” (AYP) objectives for
the federal No Child Left Behind Act, while its high school
did not because its fiscal year 2009 graduation rate of 77
percent was below its 2010 AYP target rate of 80 percent.
The District’s fiscal year 2010 89-percent graduation rate
was higher than the peer district’s 80-percent average and
the State’s 78-percent average.
District operates efficiently with most
costs lower than or similar to peer districts’
As shown in Table 1 on page 2, in fiscal year 2010, Ray USD spent a similar amount per pupil in the
classroom as peer districts—$4,954 versus $5,016. The District was able to do this despite spending
1 Auditors developed two peer groups for comparative purposes. See page a-1 of this reoprt’s Appendix for further explanation of the peer
groups.
Figure 1: Percentage of Students Who Met or
Exceeded State Standards (AIMS)
Fiscal Year 2010
(Unaudited)
Source: Auditor General staff analysis of fiscal year 2010 test results
on the Arizona’s Instrument to Measure Standards (AIMS).
0%
10%
20%
30%
40%
50%
60%
70%
80%
90%
Math Reading Writing
Ray USD
Peer Group
State-wide
page 2
State of Arizona
$895 less per pupil overall because it
operated efficiently with lower or similar per-pupil
costs in all operational areas.
Similar administrative costs but poor
controls over operations—At
$1,422 per pupil, the District’s
administrative costs were similar to the
peer districts’ average. However, lack of
oversight or controls has allowed fraudulent
activities to occur. For example, one
employee admitted to falsifying bus driver
drug testing documents and selling surplus
district property for his own profit (see
Finding 1, page 3). Further, the District
needs to strengthen controls over its
accounting system and computer network
(see Finding 2, page 7).
Lower plant operations and maintenance costs—Ray USD’s per-pupil plant operations
costs were 22 percent lower than peer districts’, and its per-square-foot costs were 43 percent
lower. Costs were lower, in part, because the District employed fewer plant staff per square foot.
Specifically, the District operated 23,876 square feet per employee while the peer districts
averaged 17,352 square feet per employee. Further, the District’s energy costs were 31 percent
lower per square foot in part because energy usage was controlled by a central energy
management system that monitored and adjusted building temperatures to keep them within a
district-approved range.
Food service program costs were lower—In addition to lower per-pupil food service costs,
Ray USD’s $2.79 cost per meal was 8 percent lower than the $3.04 peer district average. The
District’s per-pupil food service costs were lower, in part, because the District served fewer meals.
Further, the District’s per-meal costs were lower because it purchased considerably fewer general
supplies, such as cleaning supplies, than peer districts because it had supplies left over from the
prior fiscal year.
Transportation program operates reasonably efficiently—Ray USD’s transportation
program cost less per pupil than other districts, and its $1.97 cost per mile was 22 percent lower
than the peer districts’ average cost. Further, the District operated efficient bus routes, filling most
buses to an average of 86 percent of seat capacity. However, on a per-rider basis, the District’s
$1,101 cost was 38 percent higher than peer districts’ because the District transported its riders
28 percent more miles, on average. Location is a factor; the District’s campus is in the northwestern
corner of its boundaries, while students are spread throughout the District. Because of the shape
of the District’s boundaries, in order to reach students in the southern portion of its boundaries,
district buses must pass through a neighboring district’s boundaries. In addition, Ray USD also
transports open enrollment students from two neighboring districts. Both of these situations
increase the number of miles the District travels to transport students to and from school. Despite
operating a reasonably efficient program, the District did not meet all state requirements
concerning bus driver drug testing and bus preventative maintenance (see Finding 3, page 9).
Spending
Ray
USD
Peer
Group
Average
State
Average
Total per pupil $8,991 $9,887 $7,609
Classroom dollars 4,954 5,016 4,253
Nonclassroom
dollars
Administration 1,422 1,447 721
Plant operations 1,145 1,473 914
Food service 368 428 366
Transportation 444 468 342
Student support 393 625 581
Instructional
support 265 430 432
Table 1: Comparison of Per-Pupil
Expenditures by Operational Area
Fiscal Year 2010
(Unaudited)
Source: Auditor General staff analysis of fiscal year 2010
Arizona Department of Education student membership
data and district-reported accounting data.
page 3
Office of the Auditor General
FINDING 1
Poor controls over important operations allowed
fraudulent and inappropriate activities to occur without
timely detection
Fraudulent activities by two different district employees in recent years demonstrates that controls
over several aspects of the District’s operations need strengthening. Most recently, the District
allowed one employee complete control over certain aspects of district operations without any
oversight, and this employee took advantage of the lax control environment. Specifically, the
employee admitted to falsifying bus driver drug test results and selling district surplus property for
his own financial gain. At the time of this report’s release, the fraudulent acts this employee committed
are under further review by the Auditor General’s Office. The lack of oversight is even more troubling
because the District had already faced a similar situation where the lack of proper controls and
oversight allowed fraudulent activities involving a different employee to go undetected for several
months. Although both employees were terminated or resigned, the District needs to add the
appropriate controls to its operations to help ensure such abuses do not occur again, or are detected
more quickly. Another critical area in need of proper oversight and controls is the District’s building
access process. For example, one employee had the only key to a secluded office where his
computer was kept. Auditors found that this computer had been used for inappropriate activities.
Lax control environment allowed falsified bus driver drug test
results to go undetected
According to the State’s Minimum Standards for School Buses and School Bus Drivers (Minimum
Standards), districts are required to ensure that bus drivers are tested annually for drug usage and
randomly throughout the school year for drug and alcohol usage. Typically, bus drivers obtain annual
and random drug testing through laboratories or other medical facilities, such as hospitals or clinics.
However, since at least fiscal year 2001, Ray USD has used an in-house drug testing system that
involves collecting samples at the District and sending them to a laboratory for analysis. According
to district officials, the District adopted this practice as a cost-saving measure.
Although this practice can be acceptable if handled appropriately, the District allowed the in-house
drug testing process to be handled by one employee who controlled the process from start to finish.
The lack of oversight of this employee’s work and the lack of formal procedures or controls over the
page 4
State of Arizona
process provided opportunity for the employee to falsify bus driver drug test results, which went
undetected until auditors discovered them as part of their normal audit work. Auditors reviewed
files, including required drug test results, for all ten bus drivers who drove district buses during
fiscal years 2009, 2010, and/or 2011 and found five falsified drug test results. In four cases, the
employee name on the drug test document was clearly altered, and in the fifth case, the list of
specific drugs that were tested for was clearly altered.
After auditors notified district officials of the falsified drug test results, the employee admitted to
falsifying two of the five test results, and he resigned from district employment. However, this
does little to reduce the potential for abuse. To ensure the integrity of its in-house drug testing
process and test results, the District should develop policies and procedures related to the
process, including oversight and controls that would allow for quick detection of fraud. For
example, the District should consider having drug test results mailed from the testing lab directly
to the district office and opened by two employees who are not otherwise involved in the
transportation program. Further, to protect students and the public, the District should report the
falsified drug test results to the Department of Public Safety (DPS). DPS administers the State’s
Minimum Standards, which requires bus driver drug testing, among other things, to maintain
school bus driver credentials.
Employee personally profited from sale of district surplus
property
Although the District had a policy for disposing of surplus property, the same employee
discussed above was able to easily circumvent it. This employee, who was also in charge of
overseeing the installation of a new energy management system, did not follow the policy when
he sold parts from the old system for personal profit. The employee obtained the old energy
management system when the vendor removed it in order to install the new system. Rather than
notifying district office staff that he had collected surplus property and ensuring its proper
disposal, the employee removed the parts from the old system that were still working and
personally sold them on the Internet and through other means. After auditors notified district
officials of this inappropriate sale, the employee admitted receiving and keeping for himself
approximately $4,000 for the parts he sold. The employee also admitted to a prior incident of
taking and selling copper from district buildings that were being renovated. In this case, the
employee estimated he personally received about $3,000 from selling the copper.
Once again, the fact that the employee subsequently resigned does not address the underlying
problem: the policy is too easily ignored. The policy, which addresses how surplus property
should be disposed, should be strengthened to (1) include employees’ responsibility to notify
designated district officials when they identify items that could be declared as surplus property,
and (2) specify that employees should not personally take, keep, or sell any district property
unless designated district officials have determined it is allowable based on the requirements of
page 5
Office of the Auditor General
Arizona Administrative Code R7-2-1131.1 Further, the District should ensure that all current and future
employees are aware of its surplus property policy and the importance of following the policy when
identifying and disposing of surplus property by disseminating the policy to all new and current
employees once it is strengthened.
Lax control environment allowed a theft to go undetected for 6
months in the past
The fraudulent activities discussed earlier were not the first experienced by the District. In 2010, a
former employee pled guilty to stealing almost $9,000 while working in the district office. The theft
occurred in 2008, when the employee took advantage of the lax control environment to use district
credit cards to pay personal bills and to steal money from the District’s cash receipts. The theft went
undetected for about 6 months before an unusual credit card purchase signaled district officials that
something was wrong. Since this theft occurred, the District has strengthened its controls over credit
cards and cash.
Poor controls over district keys and building access further
increases the District’s risk of theft, fraud, and misuse
Another aspect of district operations that needs strengthening is its process for producing,
distributing, and tracking keys for district buildings. The District’s process for making and distributing
all building keys does not include oversight or process controls to ensure that only authorized
employees are given keys to various buildings or areas within the District. Because of the lack of
controls, the District cannot know at any point in time how many district keys exist and who has them.
Specifically,
•• The District does not have a formal key-request procedure. Employees needing keys often
verbally request them from the employee who produces the keys. In addition to producing all
keys, this employee is also responsible for numbering, distributing, and tracking the keys
without any oversight or involvement from other employees.
•• A complete and up-to-date log showing keys made and distributed is not kept.
•• Employees receiving keys are not required to sign user agreements, which would clearly outline
the rules and policies an employee must follow regarding the use of a district key and provide
additional identification of which district employee was in possession of which key(s).
•• No procedure is in place for ensuring that keys are collected from employees when they leave
district employment.
•• At least one office in the District was accessible to only one employee. Specifically, the District
allowed one employee to have sole access to a secluded office where his computer was kept.
1 According to Arizona Administrative Code R7-2-1131, a school district employee or board member cannot purchase surplus property if they
were directly or indirectly involved in the purchase, disposal, maintenance, or preparation for sale of the surplus property.
page 6
State of Arizona
Even the superintendent did not have a key to that particular office. Allowing an employee
to have sole access to a secluded office increases the risk of improper behavior, fraud, theft,
or abuse. In fact, despite a district policy prohibiting the viewing of pornography on district
computers or its network and a filter that blocks users from accessing pornographic images
from the Internet, auditors found that pornographic images had been viewed from an
external hard drive on this employee’s computer. As of fiscal year 2013, this employee no
longer works at the District. Strengthening the District’s policy to include consequences,
such as disciplinary action or dismissal, and requiring employees to sign a statement
acknowledging their understanding of the policy and its provisions would help to ensure
that the policy is not ignored in the future. Further, the computer was the only district
computer housing critical and costly energy management software used to monitor and
control temperatures throughout the District’s facilities. Since no other district personnel had
access to that office or computer, it would have been difficult for district officials to access
the energy management system in the employee’s absence.
Recommendations
1. The District should develop policies and procedures over its in-house drug testing process,
including increased oversight and controls that would allow for quick detection of fraud
and abuse, such as having drug test results sent directly to the district office and opened
by two employees who are not otherwise involved with transportation.
2. The District should contact the Department of Public Safety to report the falsified drug test
results.
3. The District should strengthen its surplus property policy to specify that employees must
notify designated district officials when they identify items that could be declared as
surplus property. Further, the policy should specify that employees should not personally
take, keep, or sell any district property unless designated district officials have determined
it is allowable based on the requirements of Arizona Administrative Code R7-2-1131. The
District should also disseminate its surplus property policy to all current and future
employees to ensure they are aware of the policy’s provisions. Finally, the District should
ensure that surplus property is disposed of according to the policy.
4. The District should implement controls over its process for producing and distributing keys
to district buildings, including numbering all keys produced, establishing a distribution log,
and creating and following a procedure for ensuring that keys are returned when an
employee leaves district employment. In addition, district officials should evaluate if and
when it would be appropriate to allow an individual to have sole access to an office and
limit such a situation as much as possible.
5. The District should strengthen its policy prohibiting the accessing of pornographic material
on district computers or its network to include consequences, such as disciplinary action
or dismissal. The District should also require employees to sign a statement indicating they
understand the policy and its provisions.
page 7
Office of the Auditor General
FINDING 2
Inadequate computer controls increase risk of errors and
fraud
Ray USD lacks adequate controls over its accounting system and computer network. Unlike the
areas discussed in Finding 1, auditors did not detect any improper transactions in these areas.
However, these poor controls expose the District to increased risk of errors and potential fraud.
Increased risk of unauthorized access to critical systems
Weak controls over user access to the District’s accounting system and network increase the risk of
unauthorized access to these critical systems.
Broad access to accounting system increases risk of errors, fraud, and misuse
of sensitive information—Auditors reviewed the District’s user access report for the four
users with access to the accounting system and found that three district employees have more
access to the accounting system than they need to perform their job duties. All three of these
employees have the ability to perform all accounting system functions. Full access in the
accounting system provides an employee with the ability to add new vendors, create and approve
purchase orders, and pay vendors without independent review. It also provides the ability to add
new employees, set employee pay rates, and process payroll payments. Access to all accounting
system functions and beyond what is required for job duties exposes the District to increased risk
of errors, fraud, and misuse of information, such as processing false invoices or adding and
paying nonexistent vendors or employees.
Weak password requirements—The District needs stronger controls over its network
passwords. Although network passwords are user-defined and must be changed periodically, the
passwords have a low-complexity requirement—that is, passwords need not contain numbers or
symbols. Common practice requires passwords to be at least eight characters and contain a
combination of alphabetic and numeric characters. This practice would decrease the risk of
unauthorized persons gaining access to the District’s systems.
page 8
State of Arizona
Lack of disaster recovery plan could result in interrupted
operations or loss of data
The District does not have a formal, up-to-date, and tested disaster recovery plan for critical
student information on its systems and network. A written and properly designed disaster
recovery plan would help ensure continued operations in the case of a system or equipment
failure or interruption. Although the District creates backups of critical data and stores the
backups in a secure location, the District does not regularly test its ability to restore electronic
data files from the backups, which could result in the loss of sensitive and critical data. Disaster
recovery plans should be tested periodically and modifications made to correct any problems
and to ensure their effectiveness.
Recommendations
1. The District should review employee access to the accounting system and modify access
to ensure that an employee cannot initiate and complete a transaction without independent
review and that each employee has only the access necessary to meet their job
responsibilities.
2. The District should implement stronger password controls, requiring its employees to
create more secure passwords that contain a combination of alphabetic and numeric
characters.
3. The District should create a formal disaster recovery plan and test it periodically to identify
and remedy any deficiencies.
page 9
Office of the Auditor General
FINDING 3
Transportation program did not meet all state
requirements
Although Ray USD’s transportation program operated reasonably efficiently in fiscal year 2010 with
per-mile costs that were lower than peer districts’, the District failed to meet two state requirements
within its transportation program—testing its bus drivers for drug usage, and documenting that
buses receive required preventative maintenance.
District did not conduct drug testing according to Minimum
Standards
In addition to the falsified drug test results discussed in Finding 1 (see page 3), the District did not
ensure that all of its bus drivers received annual or random drug testing in accordance with
requirements set forth in the State’s Minimum Standards for School Buses and School Bus Drivers
(Minimum Standards). These standards require that all bus drivers be tested annually for drug usage.
Further, the standards also require that random testing be performed on 50 percent of bus drivers
for drug use and on 10 percent of bus drivers for alcohol use each year. In fiscal year 2010, eight of
the nine Ray USD bus drivers did not receive annual drug testing. Further, although the District
randomly tested a sufficient percentage of bus drivers for alcohol use, it did not randomly test any
bus drivers for drug use.
District lacked proper preventative maintenance documentation
According to the State’s Minimum Standards, districts must demonstrate that their school buses
receive systematic preventative maintenance and inspections. Following the Minimum Standards
helps to ensure the safety and welfare of students and can help extend buses’ useful lives.
Preventative maintenance and inspections include items such as periodic oil changes, tire and break
inspections, and inspections of safety signals and emergency exits. Although the District maintained
documentation of oil changes, it did not maintain documentation, such as a checklist, to show
whether other preventative maintenance activities were performed. The lack of such documentation
means the District cannot demonstrate that its school buses are being properly maintained according
to the Minimum Standards.
page 10
State of Arizona
Recommendations
1. The District should ensure that it conducts all required annual and random drug testing as
specified in the Minimum Standards.
2. The District should develop and implement the use of a checklist to document that its
buses receive required preventative maintenance as specified in the State’s Minimum
Standards.
APPENDIX
page a-1
Office of the Auditor General
Objectives, Scope, and Methodology
The Office of the Auditor General has conducted a performance audit of the Ray Unified School
District pursuant to A.R.S. §41-1279.03(A)(9). Based in part on their effect on classroom dollars, as
previously reported in the Auditor General’s annual report, Arizona School District Spending
(Classroom Dollars report), this audit focused on the District’s efficiency and effectiveness in four
operational areas: administration, plant operations and maintenance, food service, and student
transportation. To evaluate costs in each of these areas, only current expenditures, primarily for fiscal
year 2010, were considered.1 Further, because of the underlying law initiating these performance
audits, auditors also reviewed the District’s use of Proposition 301 sales tax monies and how it
accounted for dollars spent in the classroom.
In conducting this audit, auditors used a variety of methods, including examining various records,
such as available fiscal year 2010 summary accounting data for all districts and Ray USD’s fiscal
year 2010 detailed accounting data, contracts, and other district documents; reviewing district
policies, procedures, and related internal controls; reviewing applicable statutes; and interviewing
district administrators and staff.
To analyze Ray USD’s operational efficiency, auditors selected a group of peer districts based on
their similarities in district size, type, and location. This operational peer group includes Ray USD and
17 other high school and unified school districts that also served between 200 and 599 students and
were located in town/rural areas.2 To compare districts’ academic indicators, auditors developed a
separate student achievement peer group using poverty as the primary factor because poverty has
been shown to be strongly related to student achievement. Auditors also used secondary factors
such as district type, size, and location to further refine these groups. Ray USD’s student achievement
peer group includes Ray USD and the 21 other unified districts that also served student populations
with poverty rates between 17 and 23 percent. Additionally:
•• To assess the District’s student achievement, auditors reviewed the Arizona’s Instrument to
Measure Standards (AIMS) passing rates, “Adequate Yearly Progress” for the federal No Child
Left Behind Act, and high school graduation rates. AIMS passing rates were compared to the
state-wide average and the average of the student achievement peer districts.
•• To assess whether the District’s transportation program was managed appropriately and
functioned efficiently, auditors reviewed and evaluated required transportation reports; bus
1 Current expenditures are those incurred for the District’s day-to-day operations. They exclude costs associated with repaying debt, capital
outlay (such as purchasing land, buildings, and equipment), and programs such as adult education and community service that are outside
the scope of preschool through grade-12 education.
2 The operational peer group excludes two districts that each received such high levels of additional funding that they skewed the peer-spending
averages.
page a-2
State of Arizona
driver files, including driver drug test results; bus maintenance and safety records; bus
routing; and bus capacity usage. Auditors also reviewed fiscal year 2010 transportation
costs and compared them to peer districts’.
•• To assess the District’s financial accounting data, auditors evaluated the District’s internal
controls related to expenditure processing and scanned all payroll and accounts payable
transactions for proper account classification and reasonableness. Additionally, auditors
reviewed detailed payroll and personnel records for 30 of the 120 individuals who received
payments through the District’s payroll system and reviewed supporting documentation for
30 of the 3,776 accounts payable transactions. No improper transactions were identified.
Auditors also evaluated other internal controls that were considered significant to the audit
objectives, such reviewing the District’s policies and procedures for disposing of surplus
property and controlling access to district buildings.
•• To assess the District’s computer information systems and network, auditors evaluated
certain controls over its logical and physical security, including user access to sensitive data
and critical systems, and the security of servers that house the data and systems. Auditors
also evaluated certain district policies over the system such as data sensitivity, backup,
recovery, and computer equipment and network acceptable use.
•• To assess whether the District’s administration effectively and efficiently managed district
operations, auditors evaluated administrative procedures and controls at the district and
school level, including reviewing personnel files and other pertinent documents and
interviewing district and school administrators about their duties. Auditors also reviewed
and evaluated fiscal year 2010 administration costs and compared these to peer districts’.
•• To assess whether the District’s plant operations and maintenance function was managed
appropriately and functioned efficiently, auditors reviewed and evaluated fiscal year 2010
plant operations and maintenance costs and district building space, and compared these
costs and capacities to peer districts’.
•• To assess whether the District’s food service program was managed appropriately and
functioned efficiently, auditors reviewed fiscal year 2010 food service revenues and
expenditures, including labor and food costs, compared costs to peer districts’, reviewed
the Arizona Department of Education’s food service monitoring reports, and observed food
service operations.
•• To assess whether the District was in compliance with Proposition 301’s Classroom Site
Fund requirements, auditors reviewed fiscal year 2010 expenditures to determine whether
they were appropriate and if the District properly accounted for them. Auditors also reviewed
the District’s performance pay plan and analyzed how performance pay was being
distributed. No issues of noncompliance were noted.
We conducted this performance audit in accordance with generally accepted government
auditing standards. Those standards require that we plan and perform the audit to obtain
sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions
based on our audit objectives. We believe that the evidence obtained provides a reasonable
basis for our findings and conclusions based on our audit objectives.
The Auditor General and her staff express their appreciation to the Ray Unified School District’s
board members, superintendent, and staff for their cooperation and assistance throughout the
audit.
DISTRICT RESPONSE
DISTRICT RESPONSE
Responses to the Findings and Recommendations
Ray Unified School District #3 Page | 1
Finding 1
Poor controls over important operations allowed fraudulent and inappropriate activities
to occur without timely detection.
 Lax control environment allowed falsified bus driver drug test results to go undetected.
Response: The District agrees with this finding. We have already initiated steps that
will allow for increased oversight and controls for quick detection of fraud and abuse.
Currently, drug test results are sent directly to the district office and will be opened by
two employees who are not directly involved in transportation. The Transportation
Director has contacted the Department of Public Safety to report the falsified drug test
results.
 Employee personally profited from sale of district surplus property.
Response: The District agrees with this finding. We will strengthen our current policy
which will be provided at the August 16, 2012 meeting. This will include having
employees notify designated district officials when they identify items that could be
declared as surplus property. In addition, it will specify that employees would not
personally take, keep, or sell any district property unless designated district officials
having determined it is allowable based on the requirements of Arizona Code or 7-2-
11-31. The new policy will be distributed to all current and future employees to make
them aware of the district’s surplus property policy.
 Poor controls over District keys and building access further increases the District’s
risk of theft, fraud, and misuse.
Response: The District agrees with this finding. All employees will be required to sign
user agreements acknowledging their understanding of the policy and its provisions.
The user agreement will include consequences, e.g. disciplinary action or dismissal. A
procedure will be put in place for insuring that keys are collected from employees
when they leave District employment. District officials will evaluate if and when it
would be appropriate to allow an individual sole access to an office and limit such as
much as possible.
For your information, the computer housing the energy management software is now
accessible to the maintenance director, technology director, superintendent, and
business manager. In addition, the District currently numbers all keys produced. A
key distribution log will be established at each site with a master log located at the
district office and at the maintenance director’s office.
The District will strengthen its policy prohibiting the accessing of pornographic
material on District computers or its network. This policy will also include
consequences, e.g. disciplinary action or dismissal for those employees who violate
this policy. District employees will be required to sign a statement indicating that they
understand the policy and its provisions.
Responses to the Findings and Recommendations
Ray Unified School District #3 Page | 2
Finding 2
Inadequate computer controls increase risk of errors and fraud.
 Increased risk of unauthorized access to critical systems
Response: The District agrees with this finding. The District understands the auditor’s
recommendation regarding employee access to the accounting system. However, with
only two full time employees in the District Office it would be difficult for each
employee to only have access to the information to meet their job responsibilities. In
addition, the District has always cross trained employees to safe guard against the
possibility that if either employee would be absent for an extended period of time the
job responsibilities of the employee absent could be performed by the other employee.
This is especially true if the accounts payable/payroll clerk would be absent, since
many of her duties are time sensitive. Compensating controls have been implemented
to correct this finding: (a) a second and third review of all payroll and accounts
payable warrants issued including a system generated listing, which cannot be filtered
or altered, for each voucher that details all warrants paid; (b) all requisitions are
reviewed and signed by the Superintendent and Business Manager; (c) a part time
clerk reviews and initials the listing of every payroll and accounts payable warrant
issued by the district to ensure that there are no pseudo employees or vendors paid.
 Weak password requirements
Response: The District agrees with this finding. The Technology Director sent an
email to all district employees on August 9, 2012. He has directed all staff that they
will be required to change their password to at least 8 alphanumeric characters for
Windows and SchoolMaster, beginning August 13, 2012. Besides 8 alphanumeric
characters, the password may not contain your full or partial name, the password
cannot be one used in the past 5 changes, and the password will expire every one
hundred eighty days.
 Lack of disaster recovery plan could result in interrupted operations or loss of data.
Response: The District agrees with this finding. The District is in the process of
revising the disaster recovery plan and assigning responsibilities to key personnel,
including a flow chart. The recovery plan will integrate the practice of running the
verification tool for all the backups to ensure all the files in the backup are physically
intact, readable, and can be restored in the event the recovery is needed due to
hardware failure. The backups will be tested on a monthly basis to ensure that the
integrity of the data is intact. The District will deploy an additional server to hold
replicas of all the virtual machines to use in the case of hardware failure to ensure
business continuity. Additional software is being considered to allow the District to
verify the integrity of the backup.
Responses to the Findings and Recommendations
Ray Unified School District #3 Page | 3
Finding 3
Transportation program did not meet all state requirements.
 District did not conduct drug testing according to Minimum Standards.
Response: The District agrees with this finding. Procedures for drug testing
transportation employees have been implemented. The District Superintendent
receives from Hire Right those individual(s) who must be randomly screened. The
Superintendent informs the Transportation Supervisor of those name(s). The
Transportation Supervisor schedules those employees to be tested with the District
Nurse. The nurse completes the screening and forwards to the District Superintendent
the Federal Drug Testing Custody and Control Form. A copy of this form is then
given to the Transportation Supervisor. Hire Right sends the drug test results via fax
to the District Superintendent. The District fax machine is in a secure location. This
process is followed for all transportation employees for their pre-employment or
annual tests, except that the process in initiated by the Transportation Supervisor.
 District lacked proper preventative maintenance documentation
Response: The District agrees with this finding. The Transportation Director has
developed a computer check list to document preventative maintenance/routine
maintenance on all buses.
See attached Corrective Action Plan
Corrective Action Plan
Ray Unified School District #3
Area Corrective Action
Bus driver drug testing results All current drivers to be tested immediately
Notify Department of Public Safety that drug tests were falsified
Drug test results will go directly to Dr. Dunn from Hire Right and not to the
Transportation Director
Sale of Surplus Property Strengthen current surplus property policy (DN, D‐3350).
Distribute new surplus property policy to all employees
District Keys Create an agreement form to be signed by all employees who have been assigned
a key(s)
Create a Key Control Procedure
Key log to be kept at each site and a master log to be kept in the District Office
Technology Resources Strengthen current Use of Technology Resources in Instruction Policy (IJNDB‐E, I‐
6431)
Distribute new User Agreement to all employees and track that forms are signed
and returned to the District Office by each employee
Access to Critical Systems Implement controls to prevent creation of a pseudo vendor or employee
Password Requirements System passwords must be strengthened to deter unauthorized use of critical
systems
Disaster Recovery Plan Revise the disaster recovery plan to include a procedure for back up that defines
critical resources/applications and defines the responsibilities of key personnel.
Develop a flow chart detailing the responsibilities of key personnel.
Purchase software to allow the Technology Director to verify the integrity of the
backup.
Proper PM on all District Vehicles. Document PM on District vehicles and log all such work